1. Intro to Mobile Device Testing

2. $whoami Damian Profancik Senior Security Consultant
NCC Group (formerly iSEC Partners)
@integrisec

3. North America Europe Australia Atlanta Austin Chicago New York
San Francisco
Seattle
Sunnyvale
Europe
Manchester - Head Office
Amsterdam
Cheltenham
Copenhagen
Edinburgh
Glasgow
Leatherhead
London
Luxembourg
Milton Keynes
Munich
Zurich
Australia
Sydney

4. Agenda
What?
Why?
Attack Surface
How?

5. What?
iOS (iPhone/iPad)
Android (Phones/Tablets)
Windows Phone

6. Why?
Ubiquitous
Critical data
Authentication

7. Attack Surface Web Server APIs Network Traffic Data on Device
Data in Logs
Data in Memory
Application
Source Code

8. How?

9. Jailbreak/Root Breaks app sandbox Access file system Allows SSH
Allows debugging
Disable protections (SSL pinning, JB/Root detection)

10. Bypass Jailbreak/Root Detection
iOS
tsProtector P
Snoop-it
Xcon
Android
RootCloak

11. Tools (APIs/Network)
Proxy
Burp
OWASP ZAP
Fiddler

12. Proxying Traffic
Set proxy to listen on all interfaces

13. Proxying Traffic
Download proxy CA certificate

14. Proxying Traffic
Install CA certificate on device

15. Proxying Traffic
Redirect traffic to proxy with Wifi Settings

16. Proxying Traffic Redirect traffic to proxy with VPN
Windows: PPTP VPN – Routing and Remote Access
Mac: VPNActivator

17. Proxying Traffic
Redirect traffic to proxy with VPN

18. Bypass Certificate Pinning
iOS
SSL Kill Switch
Snoop-it
Android
Android-SSL-TrustKiller

19. Attack Web Server APIs OWASP Top 10 (SQLi, XSS, XXE, etc.)
Session Management
Authentication/Authorization
Logic Flaws
Information Leaks

20. Analyze Network Traffic and Transport
Sensitive Information in URLs
HTTP
SSL v2/v3
Invalid Certificates
Weak Ciphers
Insecure Renegotiation

21. Tools (Device Data/Logs)
iOS
SSH/SCP
iFunbox
iFile
SQLite Reader
Xcode (Plist)
Keychain-Dumper
Snoop-it
class-dump-z
gdb
Android
SSH/SCP
SQLite Reader
Android Studio
keytool
XML files
adb

22. Tools (iFunbox)

23. Tools (Snoop-it)

24. Tools (iOS Logs – Xcode)

25. Tools (Android – Android Studio)

26. Tools (Device Memory) iOS Android gdb adb Android Monitor Heap Dump
Allocation Tracker

27. What To Look For Credentials Encryption Keys Cookies Payment Cards
Personally Identifiable Information
Screenshots
Session Tokens
Cached Data

28. Attacking the App SQLite Injection Device XSS
WebViews/JavaScript Bridge

29. Source Code Analysis Android iOS dex2jar apktool JAD Android Studio
gdb
Xcode

30. Q/A

31. Resources
OWASP
Mobile Top _Top_Ten_Mobile_Risks
iOS Testing Cheatsheet -
Android Testing Cheatsheet -

32. Resources Network Android
SSLyze -
Burp Suite -
Android
Android Studio -
Android-SSL-TrustKiller -
dex2jar -
Apktool -
JAD -

33. Resources iOS Xcode - https://developer.apple.com/xcode/download/
SSL Kill Switch -
iFunbox -
snoop-it -
class-dump-z -
Keychain-Dumper -

34. $whoami Damian Profancik Senior Security Consultant
NCC Group (formerly iSEC Partners)
@integrisec